Malicious code in christmasmiraclemaker (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 64f06a86dd5b916af92fc3adf5c1e5638df9eaa156a1bc122e4e647f2aae236e Packages either test the malicious behaviour, or actually download and run a simple remote script during the installation. --- Category: PROBABLYPENTEST -...

MAL-2024-12215 Malicious code in bestcolorsever (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 8335ea2981241d7eb1836338e2a942abf4f5096eb264b0ceb13e85ec435b6465 Packages either test the malicious behaviour, or actually download and run a simple remote script during the installation. --- Category: PROBABLYPENTEST -...

MAL-2024-12314 Malicious code in nirohf-reverse-shell (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 c2b0a9ce248bca096b5109a73b943559cabbd6f77433d4a64cd1c804f7ec88df Installing starts a reverse shell --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...

MAL-2025-985 Malicious code in shoots-api-test (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 78ebd73df4ce754b9e3a33af932d2b686a05716f83ccf3d7dd99029e73713acc Importing the module triggers sending out the hostname to the package author. It looks to be a placeholder/pentest activity related to BytedDance. --- Category...

MAL-2025-905 Malicious code in byted-df (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 821138aac758315c7a31a463523c4930bdd52e67699199e4c8bda0511c5907f8 Importing the module triggers sending out the hostname to the package author. It looks to be a placeholder/pentest activity related to BytedDance. --- Category...

Malicious code in kotlin-stdlib-jdk8 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 f217cf2fd34c9cab642b70bd9d778e6ef08a3dfba1954060a29983f2d3e6d47e Importing the module triggers sending out the hostname to the package author. It looks to be a placeholder/pentest activity related to BytedDance. --- Category...

MAL-2025-960 Malicious code in pytest-tt-ddriven (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 0fc281f8b24ee3d2420a1c1b3815d5c6a9a9420e0baebe4ea975d530181606a0 Importing the module triggers sending out the hostname to the package author. It looks to be a placeholder/pentest activity related to BytedDance. --- Category...

Malicious code in shoots-api-test (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 78ebd73df4ce754b9e3a33af932d2b686a05716f83ccf3d7dd99029e73713acc Importing the module triggers sending out the hostname to the package author. It looks to be a placeholder/pentest activity related to BytedDance. --- Category...

MAL-2024-12231 Malicious code in ccsinstaller (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 3e18cda71c2919c802b866f37fc87002396540fd6d3ea3f22b7703111c247518 Installing package downloads and install an infostealer --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...

Malicious code in dftester-pip (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 2e23c327cc9243e5437e6b31224c6796b90399065b451269641911b1d1982483 Example package with overwritten install command and the reverse shell --- Category: PROBABLYPENTEST - Packages looking like typical pentest packages, but also...

aiocpa 0.1.13 contains credential harvesting code

aiocpa is a user-facing library for generating color gradients of text.Version 0.1.13 introduced obfuscated, malicious code targetingCrypto Pay users, forwarding client credentials to a remote Telegram bot.All versions have been removed from PyPI...

PyPI Python Library "aiocpa" Found Exfiltrating Crypto Keys via Telegram Bot

The administrators of the Python Package Index PyPI repository have quarantined the package "aiocpa " following a new update that included malicious code to exfiltrate private keys via Telegram. The package in question is described as a synchronous and asynchronous Crypto Pay API client. The...

Malicious code in newpipv3 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 54fac2a807bae6742d82c86f55d97a1b4a810e42ee3b0b9dcb0c981c36ab712d The OpenSSF Package Analysis project identified 'newpipv3' @ 0.1.0 pypi as malicious. It is considered malicious because: - The package...

PyPI Attack: ChatGPT, Claude Impersonators Deliver JarkaStealer via Python Libraries

Cybersecurity researchers have discovered two malicious packages uploaded to the Python Package Index PyPI repository that impersonated popular artificial intelligence AI models like OpenAI ChatGPT and Anthropic Claude to deliver an information stealer called JarkaStealer. The packages, named...

Malicious code in zebo (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 27f62f0f9a2a11b03c5bbead202d9f5d58ca471041e3115eb67dd88accc22be4 Package automatically installs a script with keylogger and screenshots extraction, and sets it for an autostart. --- Category: MALICIOUS - The campaign has...

MAL-2024-11751 Malicious code in zebo (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 27f62f0f9a2a11b03c5bbead202d9f5d58ca471041e3115eb67dd88accc22be4 Package automatically installs a script with keylogger and screenshots extraction, and sets it for an autostart. --- Category: MALICIOUS - The campaign has...

MAL-2024-11668 Malicious code in pycalculater (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 84e239de4d2d6d9652a78ead4c1ebb6b3f4952aeb54dc51dc30765eaaf806368 During installation, a remote, obfuscated executable is downloaded and started. The executable at least disables automated updates, malware protection and othe...

Malicious code in discconnect (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 cd96a216a1790b73568af638b97003c7abd1f502c962137cd1084fb48ebcca64 During installation, a remote, obfuscated executable is downloaded and started. The executable at least disables automated updates, malware protection and othe...

Malicious code in pycalculater (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 84e239de4d2d6d9652a78ead4c1ebb6b3f4952aeb54dc51dc30765eaaf806368 During installation, a remote, obfuscated executable is downloaded and started. The executable at least disables automated updates, malware protection and othe...

MAL-2024-11576 Malicious code in discconnect (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 cd96a216a1790b73568af638b97003c7abd1f502c962137cd1084fb48ebcca64 During installation, a remote, obfuscated executable is downloaded and started. The executable at least disables automated updates, malware protection and othe...